Home / Production checklist
Production checklist
22 things to check before real users touch your AI-built app. Each item links to the guide or tool that helps.
Print it or copy it into your issue tracker. Nothing on this page is stored, and the boxes are just there to tick on paper.
1. Secrets & keys
- No secret keys in browser code. Anything prefixed VITE_ or NEXT_PUBLIC_ is public. How →
- Scan the whole git history for leaked keys before making the repo public, and rotate anything found. How →
- GitHub push protection is on, so new secrets get blocked at push time. How →
- Production environment variables are set in your host dashboard, then redeployed. How →
2. Database & data access
- Row Level Security is enabled on every Supabase table the browser can reach, with one policy per operation. How →
- The service_role / secret key is only used server-side. How →
- You know your free-tier limits (storage, pausing, compute hours) and what happens when you hit them. How →
- You have a backup plan. Several free tiers include no automatic backups. How →
3. Auth
4. Hosting & routing
- Deep links and page refreshes work. SPAs need a rewrite to index.html. How →
- Your server listens on 0.0.0.0 and the port your host expects (Replit, Render). How →
- Your host's free plan allows your use case. Vercel Hobby is non-commercial, for example. How →
- You have a custom domain with HTTPS, or you are happy with the free subdomain for now. How →